Extracted

• • Target

    JaffaCakes118_3f447387337591602b837f5b02ab271e

  • Size

    545KB

  • MD5

    3f447387337591602b837f5b02ab271e

  • SHA1

    33291bad68b6b05efec4eb10c1092a08b7745e85

  • SHA256

    958ada8f665a73d481ad974e482e553d2b4e84e895febe16c4766599d60a7225

  • SHA512

    ceedb818ce417c9aa078bc388f547516feccc5166bcb45c41e085da08e0e4ad8b7f19b249c73e40eec0827cf5f9a21987d5bb7f465d69a4f450e019fc7dd3ae7

  • SSDEEP

    6144:+GxhLLUnIBpvRjxiOiPUjNLByLx+iGFV46g0ZJeg8mGlN+30SvwH+kN:3TUITJxiJiNLkLKFV46pjGC30SvwH

  Score

  10^/10

  agentteslacollectioncredential_accessdiscoverykeyloggerpersistencespywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Agenttesla family

    agenttesla

  • AgentTesla payload

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses Microsoft Outlook profiles

    collection

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2